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Loss of control is the leading cause of jet fatalities worldwide. Aside from their 
frequency of occurrence, accidents resulting from loss of aircraft control seize the public’s 
attention by yielding a large number of fatalities in a single event. In response to the rising 
threat to aviation safety, the NASA Aviation Safety Program has conducted a study of the 
loss of control problem. This study gathered four types of information pertaining to loss of 
control accidents: (1) statistical data; (2) individual accident reports that cite loss of control 
as a contributing factor; (3) previous meta-analyses of loss of control accidents; and 
(4) inputs solicited from aircraft manufacturers, air carriers, researchers, and other 
industry stakeholders. Using these information resources, the study team identified the 
causal factors that were cited in the greatest number of loss of control accidents, and which 
were emphasized most by industry stakeholders. This report describes the study approach, 
the key causal factors for aircraft loss of control, and recommended mitigation strategies to 
make near-term impacts, mid-term impacts, and Next Generation Air Transportation 
System impacts on the loss of control accident statistics. 


Nomenclature 


ALPA 

Air Line Pilots Association 

AvSafe 

NASA Aviation Safety Program 

ASRS 

Aviation Safety Reporting System 

CAST 

Commercial Aviation Safety Team 

FAA 

Federal Aviation Administration 

IRAC 

Integrated Resilient Aircraft Control project 

JSAT 

CAST Joint Safety Analysis Team 

LOC 

loss of control 

LOC-I 

loss of control - in flight 

MGW 

maximum gross weight 

NASA 

National Aeronautics and Space Administration 

NextGen 

Next Generation Air Transportation System 

NT SB 

National Transportation Safety Board 

PIO 

pilot-induced oscillation 

URT 

upset recovery training 

URTA 

Upset Recovery Training Aid 


I. Introduction 

Over the last decade, loss of control has become the leading cause of commercial jet fatal accidents worldwide. 
“Well over half of the loss of control accidents included at least one fatality (80 percent in Part 121), and roughly 
half of all aviation fatalities ... occurred in conjunction with loss of control. Loss of control events are rarely 
considered incidents, due to the level of aircraft damage and injury that is likely to occur.” 1 

Loss of control accidents attract attention not only as a result of their status as the most common type of 
accident, but also because of the disturbing number of fatalities they produce. The crash of a Colgan Air regional 
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transport in 2009 resulted in widespread media attention and in proposed legislation in both houses of the United 
States Congress. 

In response to this increasing threat to aviation safety, the National Aeronautics and Space Administration 
(NASA) Aeronautics Research Mission Directorate (ARMD) Aviation Safety Program (AvSafe) office chartered a 
study of the loss of control problem. This paper reviews the primary causal factors for the loss of control hazard as 
determined by the NASA LOC study team and discusses briefly the technical challenges identified that affect near- 
term, mid-term and Next Generation Air Transportation System (NextGen) approaches to addressing the loss of 
control problem. 

The study team adopted the following definition of loss of control, from the 2000 Commercial Aviation Safety 
Team (CAST) Joint Safety Analysis Team (JSAT report on loss of control. 

Loss of control includes significant, unintended departure of the aircraft from controlled flight, the 
operational flight envelope, or usual flight attitudes, including ground events. "Significant" implies an event 
that results in an accident or incident. This definition excluded catastrophic explosions, CFIT, runway 
collisions, complete loss of thrust that did not involve loss of control, and any other accident scenarios in 
which the crew retained control. This does include loss of control due to aircraft design, aircraft malfunction, 
human performance, and other causes. 2 


II. NASA Loss of Control Study Team and Approach 

The NASA study team consisted of seven NASA engineers and scientists from four NASA research centers: the 
NASA Langley Research Center (LaRC), Hampton, Virginia, USA; the NASA Ames Research Center (ARC), 
Moffett Field, California, USA; the NASA Glenn Research Center (GRC), Cleveland, Ohio, USA; and the NASA 
Dryden Flight Research Center (DFRC), Edwards, California, USA. All team members have strong backgrounds in 
the NASA Aviation Safety Program with skills that include flight control, flight dynamics, loss of control, flight 
research, aircraft icing, human factors, flight training, pilot-human automation, human performance, and human 
error. 

The study team was chartered with identifying the key causal factors related to aircraft loss of control, making 
recommendations on candidate mitigations, and identifying supporting research for the mitigations. The time frame 
for the study was approximately three months, with one additional month for writing reports. In order to accomplish 
the objectives within such a span of time, the study team adopted the following approach. 


A. Loss of Control Study Activities 

The NASA study team: 

1) Identified a list of candidate causal factors for consideration 

2) Developed a list of stakeholders representing government entities such as NASA, the Federal Aviation 
Administration (FAA), the National Transportation Safety Board (NTSB), airframe manufacturers, airlines, 
pilot unions and training providers 

3) Interviewed subject matter experts who represent stakeholders to gain an understanding of the causal 
factors behind loss of control mishaps, and potential mitigations 

4) Reviewed previous work that addressed the loss of control hazard, such as that performed by the CAST 
JSAT and the CAST Joint Safety Implementation Team (JSIT), and that presented in technical papers, 
NASA work, the Upset Recovery Training Aid (URTA), et cetera 

5) Reviewed statistical summary reports for loss of control accidents and incidents 

6) Reviewed selected loss of control accident reports 

7) Analyzed the data and interview notes to arrive at a list of candidate mitigations for loss of control events 
and potential research topics that could help support implementation of same 

8) Prioritized causal factors, and identified candidate mitigations and supporting research topics 

9) Prioritized mitigations and research 

10) Documented findings and recommendations 

The team was directed to consider loss of control mitigations from both a short-term and long-term perspective 
with the intent of identifying mitigations that would affect the fatal accident rate as soon as possible but also would 
address the evolving state of commercial aviation, such as NextGen airspace concepts and advanced aircraft 
systems, as they are introduced. 
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B. Candidate Causal Factors 

The study team developed a preliminary list of causal factors that contribute to loss of control. This list was 
compiled through interviews, reviews of accident reports and team analysis of available data. Causal factors in the 
list were segregated into three categories: (1) pilot- or human-induced; (2) environmentally-induced; and (3) 
systems-induced. The following list does not order the causal factors by frequency of occurrence or importance. 
Pilot- or human-induced: 

1) Improper training 

2) Poor energy management 

3) Changing pilot skill base 

4) Spatial disorientation 

5) Poor pilot awareness 

6) Distraction 

7) Automation confusion or mode confusion 

8) Automation and human factors 

9) Improper procedure 

10) System integration issues (complexity, interdependencies and lack of standard interfaces) 

11) Pilot actions leading to destabilized approaches 

12) Faulty loading or shifting of cargo 

13) Incompetence 
Environmentally-induced 

1) Weather (turbulence, icing, adverse winds, wind shear) 

2) Wake vortices 

3) Hail leading to loss of control (engine performance) 

4) Visibility degrading to instrument meteorological conditions (IMC) for general aviation (GA) aircraft, 
that is, visual flight rules (VFR) flight into IMC 

5) Foreign object damage (hail, bird strike, volcanic ash) 

Systems-induced 

1) Poor design 

2) Poor energy management (systems-induced) 

3) Propulsion related (asymmetric thrust, energy management) 

4) Erroneous sensor data 

5) Air traffic operations leading to destabilized approaches 

6) Loss of control power, authority, or effectiveness 

7) Aircraft system failures (non-propulsion and propulsion) 

8) Faults or failures or damage of or to any or all of the aircraft control effectors 

9) Pilot-induced oscillation (PIO) 

III. Background on Loss of Control Accident Statistics 

A number of previous studies were reviewed as part of this effort. Two of those presented data in a manner of 
particular relevance to this study: the 2009 Boeing Statistical Summary of Commercial Jet Airplane Accidents and 
an analysis of accident data by the NASA systems analysis group on behalf of the Integrated Resilient Aircraft 
Control (IRAC) project. 

A. The Boeing Annual Statistical Summary of Airplane Accidents 

The annual Boeing Statistical Summary of Commercial Jet Airplane Accidents3 is often the motivator for 
aviation safety research. A chart from the 2009 report is included as Fig. 1 below. 
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Fatalities by CAST/ICAO Common Taxonomy Team (CICTT) 
Aviation Occurrence Categories 

Fatal Accidents - Worldwide Commercial Jet Fleet - 1999 Through 2008 


Fatalities 


1926 (65) 

□ 


External fatalities [Total 253] 
Onboard fatalities [Total 4717] 


961 (0) 


/ / 

408(23) 426(4) 


Onboard fatalities 
External fatalities 


n 


ARC Abnormal Runway Contact 

CFIT Controlled Right Into or Toward Terrain 

F-NI R re/Smoke (Non-Impact) 

FUEL Fuel Related 

LOC-G Loss of Control - Ground 

LOC-I Loss of Control - In flight 

MAC Midair/Near Midair Collision 

OTHR Other 

RAMP Ground Handling 

RE Runway Excursion 

RI-VAP Runway Incursion - Vehicle, Aircraft or Person 

SCF-NP System/Component Failure or Malfunction (Non-Powerplant) 

SCF-PP System/Component Failure or Malfunction (Powerplant) 

UNK Unknown or Undetermined 

USOS Undershoot/Overshoot 

WSTRW Windshear or Thunderstorm 

No accidents were noted in the following principal categories: 

ADRM Aerodrome 

AMAN Abrupt Maneuver 

ATM Air Traffic Management/Communications, Navigation, Surveillance 

CABIN Cabin Safety Events 

EVAC Evacuation 

F-POST Fire/Smoke (Post-Impact) 

GCOL Ground Collision 

ICE Icing 

LALT Low Altitude Operations 

Rl-A Runway Incursion - Animal 

SEC Security Related 

TURB Turbulence Encounter 


For a complete description go to: 
http://www.intlaviationstandards.org/ 


156(69) 146(69) 193(10) 

I B 8 1 


125(0) 120(0) 10 7(1) 

n n n 23(0) 0(7) 2(2) 1(0) 


Number of 
fatal accidents 

LOC-I 

CFTT 

RE- SCF-NP 

Landing + 

ARC + 

USOS 

fMC 

RE- 

Takeoff 

RI-VAP 

OTHR LOC-G 

UNK 

WSTRW FUEL 

RAMP 

SCF-PP 

F-NI 

(91 total) 

-► 22 

17 

15 5 

2 

4 

4 

5 1 

2 

2 1 

7 

3 

1 






Note: Principal categories as assigned by CAST. 
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Figure 1. Worldwide fatal accidents by occurrence category. 

A few important considerations about the chart shown in Fig. 1 are that it: 

1) Includes statistics from Part 121 aircraft weighing more than 60,000 lb maximum gross weight (MGW) 

2) Does not include statistics from aircraft manufactured in the Commonwealth of Independent States or USSR 

3) Does not include statistics from aircraft used in military service 

The data presented in Fig. 1 do not include recent accidents such as the Colgan Air crash in Buffalo, New York, 
USA, and the crash of Air France Flight 447 off of the coast of Africa. Preliminary indications are that loss of 
control occurred in both of these accidents. 

Loss of control in flight (LOC-I) is the most significant cause of commercial aviation fatalities worldwide. 
Insight into root causes is gained by examining at the details of each accident, thus, the study team reviewed 
accident summaries for each of the 22 fatal accidents noted in the LOC-I category with the goals of understanding 
the nature of these accidents and identifying the underlying causal and contributing factors. Tables 1 through 4 
present data describing worldwide in-flight loss of control accidents. 

Table 1. LOC-I accidents that occurred in each causal factor category, 1999-2008. 


Causal factor category 

Number of LOC-I accidents as 
primary causal factor 

Number of LOC-I accidents as 
contributing causal factor 

Pilot- or human-induced 

16 

22 

Environmentally-induced 

4 

5 

Systems-induced 

2 

7 
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Table 2. Causal factors contributing to LOC-I commercial aircraft fatal accidents, 1999-2008. 
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Table 4. Phase of flight in which fatal loss of control accidents occurred, 1999-2008. 


Phase of flight 

Number of fatal accidents 

Climb 

6 

Takeoff 

5 

Final approach 

3 

Initial climb 

2 

Cruise 

2 

Initial approach 

2 

Landing 

2 


Some important generalizations, presented as the list of findings below, can be derived from the data presented 
in tables 1 through 4. 

Finding 1: of the 22 accidents in the LOC-I occurrence category, the leading causal factors fall within pilot- or 
human-induced category. 

Finding 2: for large aircraft, the majority (95 percent) of recent LOC-I fatal accidents occur outside of the 
United States and Canada. 

Finding 3: the majority (81 percent) of recent LOC-I accidents occur during flight phases in which the aircraft is 
relatively close to the ground, leaving little time for corrective action, and under circumstances that are unforgiving 
of errors. 

Finding 4: flight crew deviation from prescribed procedure is a significant factor in loss of control accidents. 

Finding 5: spatial disorientation is a problem, but it occurs primarily outside of the United States. 

Finding 6: poor energy management (for example, the aerodynamic stall) is a significant factor in loss of control 
accidents. 

Accident reports in other occurrence categories were examined for relevance to loss of control. None of the 
accidents in System/Component Failure-Propulsion could be categorized as loss of control accidents. Several of the 
accidents in the System/Component Failure (Non-Propulsion) occurred in flight, but there was insufficient evidence 
to suggest that they could be strictly categorized as LOC-I. 

B. NASA Systems Analysis Study on Loss of Control Accidents and Incidents 

While the accidents cited in the Boeing annual report are good indicators for worldwide recent accident 
statistics involving larger aircraft, more data are needed to gain insight into causal factors for both incidents and 
accidents and for aircraft weighing less than 60,000 lb MGW. 

The IRAC project within the NASA Aviation Safety Program conducted a study of civil aviation accidents that 
occurred from 1988 through 2004, to identify loss of control events and causal factors. The study examined NTSB 
accident data, FAA incident data and NASA Aviation Safety Reporting System (ASRS) incident data for Part 121, 
Part 135, and Part 91 operations (commercial aviation, chartered operations, and general aviation) in order to 
identify causal factors related to aircraft loss of control for the complete range of civilian aircraft operations. The 
systems analysis results are documented in NASA/TM-2010-216261 1 (Reveley, et al.). The study team used these 
results, data from accidents listed in the Boeing annual report, and stakeholder inputs, in order to gain insight into 
loss of control causal factors. Table 51 shows loss of control events for civil aviation occurring in the United States 
from 1988 through 2004. The total for loss of control accidents is 0.1 per million flight hours for Part 121 
operations; however, the picture is grimmer for Part 135 and general aviation operations. 
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Table 5. Summary of loss of control events by operation category in the US, 1988-2004. 1 


Type of events 

Operation Category 

Part 121 

Scheduled 
Part 135 

Non- 

Scheduled 
Part 135 

Part 91 

Part 91, 135, 
& 121 
Combined 

Total Flight 
Hours 

251,751,143 

25,353,146 

49,588,000 

441,207,000 

767,896,289 

Total Accidents 

630 

217 

1115 

24473 

26435 

LOC Accidents 

26 

(4% of Total 
Accidents) 

32 

(15% of Total 
Accidents) 

198 

(18% of Total 
Accidents) 

4961 
(20% of Total 
Accidents) 

5217 
(20% of Total 
Accidents) 

LOC Accidents 
per million flight 
hours 

0.10 

1.26 

4.03 

11.24 

6.79 

Fatal Accidents 

62 

(10% of total 
accidents) 

49 

(23% of total 
accidents) 

293 

(26% of Total 
Accidents) 

4815 
(20% of Total 
Accidents) 

5289 
(20% of Total 
Accidents) 

Fatal LOC 
Accidents 

21 

(81% of LOC 
accidents) 

19 

(59% of LOC 
accidents) 

128 

(65% of LOC 
Accidents) 

2635 
(53% of LOC 
Accidents) 

2803 
(54% of LOC 
Accidents) 

Total Fatalities 

2165 

328 

698 

9146 

12337 

Fatalities in LOC 
Accidents 

1186 

(55%) 

161 

(49%) 

285 

(41%) 

5178 

(57%) 

6810 

(55%) 

Total Incidents 

7808 

2234 

2201 

29520 

41,763 

LOC Incidents 

38 

5 

8 

81 

132 

LOC Incidents 
per million flight 
hours 

0.151 

0.197 

0.161 

0.18 

0.17 


The summary shown in table 5 is one of few that provide a broad and cross-cutting view across operating 
categories. While the LOC accident rate is significantly less for Part 121 than for the other operation categories, the 
incident rates are very similar and the fatalities per LOC accident are significantly higher for Part 121 than for Part 
91. The LOC study team gleaned some important findings from the Reveley report. 

Finding 7: more than half of LOC-I events result in an accident and more than half of those accidents are fatal. 
Reveley, et al., expands further on this conclusion when considering the four operational categories: 

In flight loss of control is a serious aviation problem. Well over half of the loss of control accidents included 
at least one fatality (80% in Part 121, 64% in Part 135 and 53% in Part 91.), and roughly half of all aviation 
fatalities in the studied time period occurred in conjunction with loss of control. Loss of control events are 
rarely considered incidents, due to the level of aircraft damage and injury that is likely to occur. 
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In Part 121, loss of control was somewhat more likely to occur during approach and landing (as opposed to 
takeoff or cn route), but during takeoff a loss of control was most likely to result in a fatality. In Part 135 
flights, loss of control was most likely to occur during takeoff, although when control was lost during 
approach/landing 80 percent of the accidents resulted in fatalities. En route loss of control was both the most 
frequent and the most often fatal of the three phases in Part 91 flights. 

In 31% of Part 121 loss of control accidents, the loss of control was secondary to a system/component 
failure/malfunction, compared with 8%-12% of the accidents in other flight operation categories. Twenty- 
three percent of the Part 121 loss of control accidents were secondary to aircraft damage (most often due to 
fire), compared with 3% to 8% of the accidents in other flight operation categories. As a result, for roughly 
35% of the loss of control accidents in Part 121, aircraft control was not possible (Determined by the NTSB), 
compared with 6% to 9% of the accidents in other flight operation categories. In flights other than Part 121, 
25% to 40% of the loss of control was caused by inadequate airspeed leading to an inadvertent stall. Icing 
(both pre-flight and in-flight) and adverse winds were the primary cause of a large number of accidents. 
Other frequently cited causes for loss of control are inadequate pre-flight, improper planning or decisions, 
and flying in obscuration or at night. 1 

Finding 8: in approximately one third of Part 121 loss of control accidents, loss of control was due to a system 
component failure. 

Finding 9: approximately 34 percent of all fatal Part 121 accidents are FOC accidents. 

Finding 10: in approximately one third of Part 121 accidents, the NTSB determined control was not possible, 
although the meaning of this is not clear. For instance, did inadequate control authority exist due to damage or some 
other factor? Could the aircraft have been controllable with the aid of technology that is not currently available? 

While the Boeing Annual Report and the Reveley report are statistical summaries that provide useful insight 
into accident causal factors, it is important to use caution with any accident summary or analysis. First, the 
timeframe for accident summaries can affect the results. Certain issues may not be apparent within short time frames 
(such as 10 years) whereas they are significant within longer time frames (such as 30 years). This could be due to 
systemic reduction in certain causal factors or the cyclic nature of some causal factors. Second, statistical summaries 
do not necessarily provide important details regarding the circumstances underlying the accident, largely because 
causal factors are often summarized within broad categories. The FOC study team obtained valuable information 
from the full accident reports that was not apparent in the summaries. Finally, the identification of all contributing 
causal factors for each accident, instead of the single primary cause, was found to be most appropriate for purposes 
of identifying mitigation strategies. Therefore, further accident analysis may be needed for the development of any 
mitigation or research strategy. The accident analyses conducted by Reveley, 1 Smith 4 and Fambregts 5 all provided 
insight into causal factors but used different approaches for certain aspects of the analyses. 

IV. Mitigation Hierarchy, Classification, and Approaches 

A mitigation is an action taken to reduce the risk of exposure to a hazard. Based on System Safety Science, once 
a hazard is identified the priority for addressing the hazard should be: 

1) Hazard elimination (intrinsic safety) 

2) Hazard reduction 

3) Hazard control 

4) Damage reduction 6 

For aircraft loss of control, hazard elimination is a desirable but difficult-to-reach goal, given the nature of 
performance demands in atmospheric flight. Thus, research should focus on hazard reduction, hazard control, and 
damage reduction. 

In practical applications involving aircraft systems a more specific priority model is used. 7 

1) Design/Eliminate: design to eliminate the hazard or to minimize risk (for example, the possibility of an 
electrical fire can be eliminated by using a pneumatic system or using redundancy in flight controls to lower the 
probability of occurrence of flight control failure due to an electrical fire). 

2) Safety Devices: incorporate safety features or safety devices or both to minimize risk (for example, utilize 
safety lockout or use-inhibiting devices.) 

3) Detect/Warn: incorporate warning or caution or detection devices to minimize risk (for example, utilize a 
flashing light with a sign to indicate the presence of a hazard). Detection and warning devices may aid in notifying 
the crew of a hazardous event as well as in providing guidance toward reducing the effects of a hazardous event. 
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4) Procedures/Training: use special procedures, training, personal protective equipment, or a combination of 
any or all of these to minimize risk. Procedures and training may be applicable to avoiding a hazardous situation, 
detecting the onset of a hazardous event, and training to contain or reduce the effects of a hazardous event. 

5) Placards: use placards to minimize risk. Due to their lack of effectiveness, placards are not discussed in this 
report. 

The preferred methods incorporate elimination of or protection from the hazard through avoidance of the 
hazard, design, or the use of safety devices. These are followed by the use of detection and warning systems to 
advise that a hazard is imminent or occurring. Procedures and training are important for both prevention of and 
recovery from a hazard, but are near the bottom of the list of preferred approaches because they rely on human 
operators to remember the training and use the proper procedures. As pointed out previously, deviation from proper 
procedure is a significant factor in loss of control accidents. 

Achieving hazard elimination by developing technology and design changes for existing aircraft designs is 
expensive and is likely to take decades to affect loss of control accident statistics. This is true of all existing aircraft 
and will likely remain true for all aircraft flying through the year 2020. NextGen aircraft (N+2 and later) may benefit 
from research that is performed related to aircraft and systems design; however, designing out the loss of control 
hazard while achieving some of the other goals associated with NextGen will be very difficult. 

Incorporating safety features or devices that minimize risk, such as inhibitor devices, is more likely to have an 
impact on future aircraft. Retrofit-able avionics systems may be able to “buy” their way onto the airplane if they 
offer some additional performance or monetary benefit to the operators that will fly them. 

A similar argument is made for warning or caution or detection devices. It may be possible to incorporate these 
mitigators with equipment that is required for aircraft to operate within the NextGen architecture; however, 
integration onto existing aircraft will not likely happen without a legislative or financial incentive. 

While next-to-the-bottom-of-the-list for preferred mitigation approaches, procedures and training are likely to 
have the largest impact on the loss of control hazard in the near term. Any new technology that migrates into 
commercial aviation will have limited impact on loss of control accident statistics in the near term and will likely 
first be incorporated onto aircraft that already receive the best maintenance and are flown by the most experienced 
pilots. 

On the other hand, research to support loss of control prevention and recovery training may be applied and may 
affect accident statistics in as little as a few years after completion of the research; however, there is a cost 
associated with training. The LOG training would need to “earn” its way into current training curricula. Training and 
procedures are often considered a stopgap measure; however, the technology infusion gap in commercial aviation 
can be measured in decades. For commercial aircraft operations, most loss of control accidents with fatalities occur 
outside of the United States and Canada on older aircraft that were purchased used from premium carriers. In the 
United States, Part 135 and Part 91 operations have the highest frequency of loss of control accidents and are the 
least likely group to be effected by technology improvements, for economic reasons. Research tasks that support 
improved training and procedures are the most important for a near-term impact on the loss of control statistics. 

The topic of “technology insertion” should be a critical element of any LOC mitigation strategy. While the 
primary impact of certain technologies may be long-term, it is important to identify the areas in which they could be 
inserted as soon as possible, to accelerate technology readiness. For example, integrated aero-propulsive controls 
may progress from manual implementations to full automatic implementation as part of the maturation process. 
Also, while certain barriers to technology insertion exist, such as certification or cost, these barriers may be reduced 
through unexpected circumstances or the gradual implementation of technologies. 

The aircraft loss of control problem results from numerous primary causal factors and contributing causal 
factors that may occur individually but quite often occur in combination. Loss of control usually occurs in an off- 
nominal condition that may creep up gradually, but it can occur suddenly without warning. Typically, it is a surprise 
to the pilot. Loss of control occurs across all operational categories. Usually there is a chain of events that precedes a 
loss of control event and, unlike the controlled flight into terrain (CFIT) problem, for which the fatality rate has been 
drastically reduced by the required use of terrain alert warning systems (TAWS), 8 there is no single unifying 
mitigation technology strategy that will address the majority of loss of control causal factors. Breaking the chain of 
events is an important approach in effective mitigation for aircraft loss of control. If the complex loss of control 
chain is broken at any link, the event is not likely to occur. 9 

In an effort to address breaking the chain of events in aircraft loss of control at multiple points, the LOC study 
team chose to classify the mitigations by the manner in which the mitigations would be applied to a loss of control 
event. The mitigation application categories are Avoid, Detect, and Recover. 10 
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Avoid: avoidance is usually tied to the design of systems that eliminate the hazard and safety mitigations but 
may also include standard operating procedures and training to avoid loss of control scenarios. These mitigation 
strategies include: 

1) Aircraft designs and system architectures that are not susceptible to loss of control events 

2) Remote sensing of atmospheric hazards that may trigger upset conditions: convective weather, clear air 
turbulence, wake turbulence, icing flight conditions 

3) Portrayal of and decision support for the pilot of geospatial location, extent, and relative movement of 
atmospheric hazards to enable flight around them 

4) Relationship of air traffic operations to potentially de-stabilized maneuvering 

5) Envelope protection and lockout devices to prevent unsafe energy states 

6) Training to avoid hazards that could lead to loss of control 

Detect: detection is tied to the detect/wam category of mitigations and these mitigation strategies but may also 
include training to recognize the onset of a hazardous situation: 

1) Sensing immediate occurrence of de-stabilizing flight conditions 

2) Sensing the vehicle condition (including damage, degradations, and ice accretion) that may create, promote, 
or trigger a loss of control event, correctly interpreting sensor input, and alerting with sufficient accuracy 
and look-ahead to facilitate an improved response from the pilot or onboard systems, or both 

3) Pilot awareness and cueing of unusual flight attitudes or energy states, and other conditions suggesting the 
potential onset of a loss of control event 

4) Training to recognize external hazards such as weather, turbulence, and wake vortex conditions. 

5) Adverse vehicle-pilot interactions potentially leading to loss of control events, considering current and novel 
flight configurations, with and without intermediary flight control or stability-augmentation systems 

Recover: recovery is the last line of defense and has strong ties to the procedures/training category, but may 
also benefit from automatic systems, safety devices, and warning devices to aid in the recovery of the vehicle. These 
mitigations may include: 

1) Piloted (manual) control of flight vehicles in an upset or loss of control flight condition; may include 
training, procedures, and technologies to mitigate problematic behaviors including pilot cueing and stability 
augmentation technologies 

2) Automatic recovery of flight vehicles from an upset or loss of control flight condition 

3) Flight dynamic models of the post stall environment. 

V. Stakeholder Viewpoints on Aircraft Loss of Control 

For the purposes of this study, stakeholders are groups with an interest in aircraft loss of control. Stakeholders 
consist of regulatory agencies, research groups, air carriers and operators of aircraft, and manufacturers of aviation 
equipment. The study team members communicated with stakeholders and collected inputs in order to gain insight 
into the most pressing issues facing regulatory agencies, operators, and equipment manufacturers, related to loss of 
control. Over thirty stakeholders from the following organizations were interviewed; 

1) Regulatory agencies, such as the FAA and the NTSB 

2) Operators, such as the Air Fine Pilots Association (ALP A), commercial pilots, and safety directors for 
airlines 

3) Manufacturers, such as The Boeing Company, Airbus, S.A.S., and Honeywell International 

4) Other organizations, such as CAST, NASA, Calspan, and Flight Safety International. 

The LOC study team’s discussions with stakeholders revealed some consistently conveyed ideas describing the 
most important mitigations for the loss of control hazard. 

Envelope protection, envelope limiting and energy management (Avoid LOC). There are many causal 
factors that lead to exceeding an aircraft’s flight-qualified envelope and normal operating envelope. These include 
spatial disorientation, upsets, crew inattention, poor energy management, mode confusion, improper procedures, and 
improper training. Stakeholders indicated that a high-priority mitigation toward preventing LOC is inhibiting an 
otherwise healthy aircraft from entering an unsafe condition. There are two schools of thought that have shaped the 
design approaches to envelope protection systems: one is to utilize automated systems to prevent the aircraft from 
exceeding the safe operation envelope, and the other is to give the crew all the aircraft control authority they need to 
recover from a loss of control situation. Potential mitigations include: 

1) Envelope protection: understand the benefits and identifying potential hazards 
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2) Envelope limiting: a new concept similar to envelope protection that incorporates the benefits of envelope 
protection but allows full aircraft control authority when such is demanded by the pilot. Identification of 
human factors hazards with unanticipated use is crucial for successful implementation. 

3) Displays and automation for improved energy management 

4) Automatic use of the propulsion system for envelope protection: thrust asymmetry identification and 
protection, use of integrated propulsion control for energy management, upset prevention and recovery 

5) Partnerships to participate in verification and validation of these technologies. 

Improved automation for human factors Mitigation (Avoid LOC). Stakeholders indicated that complexity 
of automatic systems, poor system architecture and a lack of human factors considerations in automatic systems are 
a key causal factor in aircraft loss of control. Potential mitigations include; 

1) Reduced complexity in automation interfaces 

2) Improved models of systems for increased pilot understanding 

3) Improved feedback to the pilot about the state of automatic systems 

4) Improved coordination between autopilot and autothrust systems 

5) Automatic prevention of loss of control and pilot aids for recovery from a loss of control event. 

6) Reduced “startle factor” for changes in automation (“bark before bite”) 

Training for upset prevention and recovery (Avoid, Detect, and Recover from LOC). Stakeholders are 
widely divided on the topic of training for loss of control recovery and prevention. All stakeholders agree that 
training to address loss of control prevention is key, but disagreements begin when attempting to determine the point 
in the flight envelope at which the training should end. For example, some manufacturers insist that simulation 
training should end at the point that the stick-shaker or stall warning is activated. The Upset Recovery Training Aid 
(URTA) 11 developed by The Boeing Company, Airbus, S.A.S., and Flight Safety International is a reference for 
raising awareness about the flight dynamics of an aircraft in an upset condition, but is mostly used for academic 
purposes with limited application in the simulation. Stakeholders indicate that this document is not widely used in 
standard training curriculum, but is used by some vendors for elective training. The primary arguments against upset 
recovery training (URT) in simulators and surrogate aircraft are the potential for negative training, the lack of 
proven effectiveness, and the cost associated with model development and validation beyond the normal flight 
envelope. Pilot unions and operators are at odds with regard to upset prevention and recovery training. The pilots 
would like more training and the operators point to the phenomenal safety record of commercial aviation. 
Stakeholders indicated some key needs toward addressing LOC prevention and recovery training: 

1) Conduct research that may be used to develop training products for externally-induced loss of control (icing, 
wind shear, wake vortex, turbulence, heavy rain). To ensure system-wide knowledge of externally-induced loss of 
control, training products should target flight crews, ground crews, aircraft operator dispatchers, and air traffic 
controllers. 

2) Identify the most effective way to train pilots to mitigate loss of control events: 

a) Determine effective ways to utilize the URTA in training. 

b) Investigate the advantages and hazards associated with using motion-based and fixed-based simulations 
for training. 

c) Perform research to understand where motion in simulation is most effective (seat cushion, gyroscopic 
devices, in-flight simulation, aerobatic training). 

d) Prevention and recovery training: perform research that would give regulators, manufacturers, and 
operators guidance on the effective use of prevention training and the appropriate use of recovery training. 

e) Research to determine when URT should be introduced to pilots during their career and how often to 
train for upset recovery to maintain proficiency. 

Aerodynamic and dynamic model development for upset prevention and recovery (Recover). Stakeholders 
that are both for and against URT in simulators acknowledge the expense of developing models outside of the 
normal flight envelope (that is, flight within the linear region of angle of attack and sideslip) and that the models 
required for upset recovery are specific to each aircraft model. This implies a tremendous development cost in order 
to develop representative models for the numerous aircraft models. Of significant concern to stakeholders is 
adequately modeling aircraft dynamics beyond the nominal flight envelope or in the presence of external influences 
such as wake vortex or icing. Inaccurate modeling may lead to negative training and ultimately loss of life as 
evidenced by the 2004 crash of AA587. 12 Stakeholders indicated that some key needs in the areas of aerodynamic 
and dynamic model development for upset prevention and recovery are: 

1) Methods for accurate and cost-effective modeling outside the normal flight envelope 

2) Development of generic models for upset prevention and recovery that include: 

a) Multiple configurations 
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b) Generic trends in models that can be used in training 

c) Evaluate the effectiveness of generic models in training for specific aircraft types 

d) Generic models that do not contribute to negative training 

3) Research to determine control effectors most appropriate for loss of control recovery: 

a) Control effectiveness in unusual attitudes 

b) Use of the propulsion system as an effector 

c) Control allocation strategies. 

Detection and notitication of pending upset condition (Detect). Stakeholders consistently emphasized the 
need to identify the development of a pending upset condition and provide the crew with sufficient information so 
they can take appropriate action to prevent an upset. Quite often the crew are caught off guard at the onset of an 
upset condition and have only seconds within which to identify the correct response. Incorrect responses may lead to 
an unrecoverable condition. Technologies are needed that: 

1) Identify and warn of degraded energy states 

2) Provide asymmetric thrust detection and notification 

3) Identify and notify of spatial disorientation 

4) Predict and mitigate PIO 

5) Detect icing conditions and buildup and provide notification 

6) Detect aircraft aerodynamic changes using real time system identification. 

VI. Most Significant Causal Factors for Aircraft Loss of Control 

In response to the short time frame of the NASA loss of control study, the LOC team developed a hybrid 
approach to rapidly identify the most significant causal factors. The LOC team gathered four types of information 
pertaining to loss of control accidents: statistical data; individual accident reports that cite loss of control as a 
contributing factor; previous meta-analyses of loss of control accidents; and inputs solicited from aircraft 
manufacturers, air carriers, researchers, and other industry stakeholders. By using this approach, the LOC team 
concluded that the most significant category contributing to loss of control is human-induced causal factors. 
Typically this means that an otherwise healthy aircraft experiences a loss of control due to inappropriate human 
action. At a distant second and third place are causal factors related to systems-induced LOC and environmentally- 
induced LOC. 

The accident and incident statistics indicate that when a loss of control event occurs, it is most often a result of 
human error. Unfortunately, there are no statistics to indicate how often a human has intervened to prevent loss of 
control. Clearly, having a pilot is beneficial; however, the loss of control study team has identified important causal 
factors related to loss of control in which human error is involved. Providing tools for training and aiding the pilot to 
avoid, detect, prevent, and recover from, loss of control is an important impact the aviation community can make 
toward reducing loss of control events. 

A. Human-Induced Loss of Control 

Human-induced loss of control is by far the most important category to address within the aircraft loss of 
control hazard. The LOC study team categorized the most prominent human-induced loss of control causal factors: 

1) Manual handling errors 

2) Poor energy management 

3) Automation effects on human-induced loss of control 

4) Spatial disorientation and improper procedures 

Manual handling errors. Manual handling errors were flagged by a number of loss-of-control accident 
analyses that cite inappropriate or erroneous control inputs by the flight crew in response to abnormal events or 
flight regimes. These accidents raise the question of “To what extent pilots are being trained to handle such events?” 
In the past, a larger proportion of air carrier pilots came from military aviation backgrounds. These pilots typically 
received extensive aerobatic training and left the training environment comfortable flying in a variety of aircraft 
attitudes, usual and unusual. Pilots who are trained in the general aviation environment receive minimal training in 
flying in or recovering from unusual attitudes. In fact, the current standard is to train commercial pilots in the 
simulator on upset recognition and stall recognition but not to simulate upset recovery. These pilots acquire the feel 
of an aircraft in linear, stable flight regimes but do not necessarily understand the limits of the flight envelope. Some 
pilots electively pursue aerobatics training, but no such requirement presently exists for the issuance of any existing 
FAA pilot certificate or rating, or as a hiring requirement for employment with an air carrier. 
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The arrival of advanced cockpit automation for the general aviation fleet, has created a trend away from 
teaching and practicing basic stick-and-rudder skills and toward teaching those skills that focus on the use and 
management of cockpit automation. Since in-flight training for upset recovery in large airplanes is generally 
considered an unacceptable risk, current training approaches focus on the ground training for upset awareness, and 
hands-on training that is conducted in flight simulators. Both of these methods have limitations, and concerns 
remain regarding the proper method to use to train for the wide variety of upsets than could occur. 

Deterioration of manual flying skills due to increased reliance upon automation is a strong contributor to 
manual handling errors. Some airline policies and procedures favor the use of automation during most phases of 
flight, causing further deterioration of manual flying skills. This deterioration in skill provides further 
encouragement to place even more emphasis on automation and less emphasis on manual flying. Thus, when 
piloting skill is needed to prevent or recover from a loss of control scenario, the basic manual flying skills are 
absent, either never having been fully developed or having atrophied to dangerous levels. 

The need for consistent implementation of upset training has been recognized by industry and government, 
which has led to focused technical conferences such as the Royal Aeronautical Society, Flight Simulation Group, 
June 2009, proposed mandated upset training (FAA-2008-0677, Notice No. 08-07) and the formation of working 
groups such as the International Committee For Aviation Training in Extended Envelopes (ICATEE). The CAST 
identified upset training as an important intervention strategy (JSAT Intervention # 35912) and recommended 
specific research for addressing the limitations of upset training implementation. These activities and others have 
proposed research that should be addressed in order to advance upset training. 

Poor energy management. In large airplanes, energy management refers to the ability to know and control the 
complex combination of the aircraft’s airspeed and speed trend, altitude and vertical speed, configuration, and thrust. 
The penalty for improper energy management can be de-stabilized approaches, excessive pilot workload leading to 
distraction, and ultimately inadequate altitude or airspeed to recover from a loss of control event (for example, a 
stall). Poor energy management during flight phases in which the aircraft is close to the ground are most often 
unforgiving and lethal. 

Many loss of control incidents or accidents can be attributed to improper management of airspeed, especially 
those leading to aerodynamic stall or departure from controlled flight. Some examples include inattention to 
airspeed during approach and landing (Colgan Air, in January 2009, and Turkish Airlines in February 2009) from 
which recovery becomes increasingly difficult as altitude decreases. This can be due to a wide range of factors 
including improper monitoring, distraction, sensor error or failure, or weather-related factors. Improper glide path 
control, which is especially critical during precision approaches, can lead to large control inputs and, consequently, 
excessive airspeed excursions. 

Several accidents appear to have occurred because of a lack of awareness of a degrading energy state. The 
reason for this is not clear, but issues include autoflight monitoring and warning, workload, and distractions. In the 
event of excessively low airspeed or stall, current transport airplanes typically rely on stall warning systems such as 
stick-shakers as the principal mitigation to prevent loss of control. The Turkish Airlines (February 2009) crash 
occurred due to an altitude sensor failure during approach that in turn caused a premature autothrottle mode change. 
The experienced crew did not detect the decreasing airspeed condition until the stall occurred, resulting in the 
accident. 

Several accidents have occurred in which the pilot intentionally overrode the stall inhibitor system (stick- 
shaker) for no apparent reason. Research is needed to address inadvertent stick-shaker override and the effectiveness 
of stall prevention systems as well as the human interactions with and tactile cues provided by these systems. The 
Machiques, Venezuela MD-82 crash (August, 2005) involved a high-altitude stall in which the stick-shaker was 
reported to have been activated and maintained to ground impact. This behavior has been documented for numerous 
accidents, and raises the issue of the effectiveness of stall prevention systems. It is recognized that a lack of training 
may be partly to blame, because exposure to stall prevention systems is not part of the training curriculum. The first 
time a pilot experiences a stick-shaker is usually during a revenue flight with passengers on board. 

Automation effects on human-induced loss of control. The most prominent causal factors related to 
automation effects on human-induced loss of control are pilot misunderstanding of automation, poor feedback to the 
pilot about the state of automation systems, and failure of an automation system. The number of automated systems 
in the cockpit continues to steadily increase, as does the number of features provided by such systems, along with 
the number of operational modes that interact with one another to produce complex behaviors that are difficult to 
understand and predict. In addition to the complexity of normal systems operation, the history of accidents and 
incidents also points to the problem of “corner cases:” cases in which the automation exhibits behaviors that are 
unexpected or undesired that have gone undetected during the validation and verification stages of design. 
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A second contributor to pilot confusion about automation is the poor feedback often provided by automated 
systems. A number of accidents have occurred when an automated system detected an anomalous condition, 
attempted to correct the anomaly, reached its operational limits, and then suddenly handed control of the aircraft 
back to the flight crew. Surprised and out of the loop, the flight crew is often unable to respond in time to save the 
day. 

A third contributing factor to pilot confusion regarding automation stems from the reliability of the automated 
systems themselves. Many types of system failures rarely occur, giving pilots few opportunities to practice dealing 
with them. As well, failures may occur up-and-away or close to the ground, leaving little time for diagnosis and 
progression through emergency procedures. 

B. Systems-Induced Loss of Control 

Systems-induced loss of control is a distant second to human-induced loss of control causal factors. Modern 
aircraft systems are extremely safe. Design standards for flight-critical systems have failure probabilities such that 
failure should never occur during the operational life of all airplanes of one type. 1 3 It is typically assumed that flight- 
critical components have a failure probability rate of 10' 9 per hour of operation. 14 

Even with stringent reliability guidelines, systems failures of flight-critical systems do occur. According to 
Reveley, 1 system component failure/malfunction (SCFM) or damage is the trigger in approximately one third of Part 
121 LOC accidents. In Part 135 operations, approximately 11 percent of LOC accidents are triggered by SCFM or 
damage, and in general aviation (Part 91 operations) they account for 8 percent of the LOC accidents. 

System faults may be the direct cause of loss of control, they may be a trigger which leads to a loss of control, 
or they may be a contributing factor in a loss of control event. Triggers may originate from onboard the aircraft or 
come from the air traffic system within which the vehicle is operating. 

Some systems-induced loss of control accidents are not caused due to failure or damage, but may be the result 
of a poor system design that triggers a loss of control event. Examples include unintended use of the automatic 
system, designs not accounting for unforeseen hazards, or a lack of redundancy management. The systems are 
functioning properly, but they were not designed to be resilient to all possible anomalies. The following is a list of 
causal factors associated with systems-induced loss of control: 

1) Poor systems design: 

a) Poor energy management systems 

b) Poor redundancy management 

c) Autopilot modes leading to loss of control 

d) PIO 

2) Aircraft system faults or failures or damage (non-propulsion): 

a) Erroneous sensor data 

b) Loss of control power, authority, or effectiveness 

c) Display errors 

3) Propulsion system faults/failures/damage 

4) Fire 

Design of aircraft systems has evolved over decades. Systems features and functionality have improved, but 
maintain many of the characteristics from previous designs. This is often due to an operational need for 
commonality between aircraft and systems or because of the certification process. While many design features are 
being improved and made safer, there are still many that continue to affect the loss of control accident statistics. The 
following discusses some examples of systems design characteristics that contribute to loss of control events. 

Legacy systems are still in use, that have incorporated poor redundancy management systems. For example, 
recent accidents were the result of the pilot manually selecting a faulty air data probe. New designs incorporated into 
the A380 (Airbus, S.A.S., Toulouse, France) and B787 (The Boeing Company, Chicago, Illinois) provide a 
reasonable estimate of air data, even in the event that all air data probes are faulty, through the use of sensor fusion 
between inertial and air data systems. 

As previously discussed, improper use of autopilot modes continues to be a problem. The human operator often 
receives the blame, but the root cause may be the system design. For example, there is no requirement for 
coordination between the autopilot and autothrottle systems. They may be used independently of each other with 
only a small annunciation to the pilot. An incident cited in the 2008 CAST report on mode confusion cites a B777 
(The Boeing Company, Chicago, Illinois) that attempted to take off with the autopilot turned on and the autothrottles 
turned off. The crew didn’t realize the misconfiguration until the pilot flying attempted takeoff rotation and was 
prevented from becoming airborne by the autopilot. 15 A requirement for coordination between autopilot and 
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authothrottles, or logic to prevent engagement of the autopilot on the takeoff roll would have prevented this incident. 
There are numerous other examples in which the autopilot and autothrottles have been inappropriately used together. 
Incorporation of logic to force their proper use would prevent these kinds of loss of control events. Other examples 
include display malfunctions that have occurred due to poor verification and validation while integrated into the 
cockpit. 

The startle factor often occurs when the autopilot disengages and hands control to the pilot in a highly dynamic 
transient condition. Better designs that incorporate warnings and more graceful transition of control should be 
required. 

Energy management related to aircraft systems continues to be a problem that can cause loss of control. The 
aircraft, for a variety of reasons, is allowed to get slow and low to the ground, where triggers for loss of control are 
unforgiving. The Birgenair accident (February, 1996) was an example of a situation in which systems failures, 
misinterpretation of systems annunciation, poor energy management, and lack of recognition of a stall, all 
contributed to the lack of recovery from the loss of control event. 

Poor energy management may result due to faults, failures or damage. During a system failure there may be 
reduced engine performance, increased drag due to external damage, or a loss of control surface effectiveness. These 
factors typically result in an increased workload for the crew, reduced maneuvering margins, nonlinear flight 
dynamics, and poor handling qualities. Each of these factors may result in poor energy management and act as a 
trigger for a loss of control event. In an emergency, the crew must first be able to retain control of the aircraft, then 
manage the energy state, and ultimately return the aircraft safely to the ground. Effective tools are needed for the 
pilot to safely control the aircraft and manage the energy state during one of these events to prevent a loss of control 
trigger. 

Strategies for airplane control during faults, failures, or damage must consider the limitations of the pilot in 
recognizing and adapting to abnormal handling qualities. Pilots currently learn manual control characteristics for a 
normal, or unimpaired, airplane by way of flight and simulator training. Pilot training for abnormal conditions is 
generally limited to those needed for certification requirements, such as engine failures, and certain control surface 
failures, such as runaway trim. It must be recognized that the ability of, or opportunity for, a pilot to learn the control 
strategy and available envelope for an impaired aircraft is extremely limited and probably unrealistic for many 
failures or damage cases. Based on data from previous accidents, it can be assumed that the pilot may have only a 
few seconds within which to develop and learn a control strategy to safely maneuver the airplane. This 
accomplishment essentially requires the skills of a test pilot. In the cases of United Airlines Flight 232 (July, 1989) 
and the DHL A300 (November, 2003) the aircrews were successful in maneuvering the aircraft because they had 
adequate time after the event occurred to learn how to fly their “new” airplane, a luxury which typically would not 
exist during a significant failure or damage scenario. The difficulty in developing this skill is highlighted by recent 
in-flight upset training programs in which rudimentary control failures are a significant piloting challenge. 

Accurate sensor data are critical to monitoring critical aircraft states and for control system functions. For 
example, airspeed and altitude measurements are critical for proper energy management and stall avoidance. 
Airspeed and altitude sensors are susceptible to errors due to pitot-static system malfunctions; some accidents have 
been attributed to conflicting information between redundant systems. 

Several recent accidents highlight the impact of erroneous sensor data. The Birgenair accident (February, 1996) 
was the result of erroneous airspeed data, although several minutes transpired from first indication of the failure 
until the crash. In this case, the captain’s airspeed indicator was erroneous due to a blocked pitot tube that gave the 
indication that airspeed was increasing during climbout. This in turn led to a stall from which recovery was never 
achieved although the stick-shaker was activated. The Korean Air accident (December, 1999) involved an unreliable 
attitude director indicator (ADI) that resulted in excessive bank angle and subsequent ground impact. In 2008, two 
separate Qantas Airline flights experienced autopilot disengage due to a failure in the air data inertial reference unit 
(ADIRU). During the first flight, the A330 (Airbus, S.A.S., Toulouse, France) experienced a severe pitch-over 
resulting in significant injuries to unrestrained passengers. 

Recent designs exist which incorporate sensor fusion between the air data and inertial systems. Accidents such 
as the February, 1996 Birgenair accident would not occur with these systems because ADIRU technology provides a 
valid air data estimate even with all of the static ports blocked. As stated earlier, the B787 (The Boeing Company, 
Chicago, Illinois) has already integrated this type of system. Birgenair-type accidents, however, have been replaced 
by Qantas-type accidents likely due to shortcomings in verification and validation methods. 

A number of different propulsion-system related causal factors have been identified that resulted in untenable 
asymmetric thrust for an aircraft in flight or in insufficient power during takeoff or landing such that the loss of 
control of the aircraft resulted. Loss of control accidents rarely have a single cause, but are, rather, a result of a 
number of malfunctions or unfamiliar piloting situations occurring simultaneously or in rapid succession. 
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C. Environmentally-Induced Loss of Control 

Factors external to the aircraft are often a significant causal factor in loss of control accidents. In today’s 
aviation world, very few accidents have a single cause. Typically, a number of causal factors must be lined up to 
cause a loss of control accident. Very often the trigger that initiates an accident sequence is an external 
environmental factor. These factors are predominantly weather-related, however, they can also be traffic-related 
(such as wake vortices) or biologic (such as bird strikes). Based on NTSB, FAA, and NASA database information, 
the five environmentally-induced loss of control causal factors have been prioritized. Table 6 presents the causal 
factors in priority order for environmentally-induced loss of control. 

Table 6. Environmentally-induced loss of control causal factor frequency (Reveley 1 ). 


Causal factor 

Partsl21 and 135, 
scheduled 
(40 LOC accidents) 

Part 135, unscheduled 
(159 LOC accidents) 

Part 91 

(4,287 LOC accidents) 

Icing 

54% 

27% 

6% 

Turbulence 

11% 

22% 

20% 

Degrading visibility 

9% 

14% 

18% 

Heavy rain 

6% 

5% 

2% 

Low-level wind shear 

4% 

3% 

2% 


These environmental hazards can either directly or indirectly cause a loss of control accident. For example, a 
severe ice accretion can cause such drastic aerodynamic degradation that the aircraft becomes uncontrollable; icing 
can cause a drag increase such that an inattentive flight crew lets the speed degrade to wing stall; or an ice accretion 
can limit control effectiveness so that in an emergency maneuver the aircraft becomes uncontrollable. While all of 
these accident scenarios would play out very differently, they can all be described as having been triggered by the 
aircraft’s initial encounter with atmospheric icing conditions. 

Just as the same environmental trigger can cause different accident scenarios, the resultant loss of control 
accident can be prevented by way of several potential mitigations. Most of the environmental causal factors can be 
completely avoided. Avoidance results in the lowest potential for harm to the aircraft its crew and passengers, thus, 
it is always the preferred option. Avoidance, however, is rarely 100 percent effective, so reliance on early detection 
and exit is the next best strategy. If both of these opportunities are missed, the final possible mitigation to prevent a 
loss of control accident is recovery. The level of risk increases as a potential accident scenario plays out, and the 
number of potential mitigations correspondingly decreases, thus the earlier a loss of control causal factor is 
mitigated, the better. Avoidance mitigations, therefore, are almost always preferred over detection and recovery. 
Accordingly, research to enable avoidance mitigations should in general be favored over that required for detection 
and recovery, other factors being equal. Similarly, detection mitigation related research should be favored over that 
required for recovery mitigations. Other factors to be considered in prioritizing research include such things as 
probability of success, expected time to implementation, cost, and likelihood of implementation. 

VII. Recommended Mitigations and Technical Challenges 

A sympathetic read of loss of control accidents leaves little hope of a reduction in occurrence if efforts toward 
improvement are aimed in a single direction or remain within a single category. Recognizing this, the study team has 
attempted to identify as many causal factors as possible within each of these three categories, and to recommend 
potential mitigations that might help eliminate the presence of each causal factor during flight. While examining 
aircraft loss of control across the spectrum of causal factors, the team observed several recurring themes. A review 
of these areas indicates there are some foundational activities that support mitigations for a range of causal factors. 

1) Improved health monitoring of aircraft systems is seen to contribute to mitigation strategies related to 
onboard system failures and external influences such as icing. 

2) The need for improved modeling in adverse conditions such as outside-the-envelope flight is a fundamental 
element in many loss-of-control mitigations, and supports the development of manual and automatic 
prevention, recovery, and control strategies. This includes tools for model development, systems 
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identification, and strategies for developing generic models that apply to multiple platforms. These 
activities may also support modeling for ice contamination and damage conditions. 

3) Research to support improved loss of control training for prevention and recovery of aircraft loss of control 
is a first line of defense. This includes appropriate use of theoretical training on the physics of loss of 
control, simulation-based training, and in-flight simulation. 

4) Research in identifying maneuver boundaries and limiting the flight envelope is also seen to be beneficial 
for a range of mitigations, encompassing human, environmental, and systems-induced LOC events. 

5) Research to provide the pilot with increased awareness about the health and state of the aircraft and its 
automatic systems in order to avoid a loss of control event. 

6) Integrated aerodynamics and propulsion control that incorporates energy management will provide 
mitigation for many loss of control hazards. 

7) Automatic control system technology to provide good handling qualities at all times in order to avoid a loss 
of control event. 

8) Data mining of accident reports or incident reports and flight operational quality assurance (FOQA) data to 
identify causal factors in loss of control. These actions will enable the identification of patterns, trends, and 
behaviors that lead to loss of control and allow changes to be made in training and procedures to prevent 
future loss of control events. 

9) System safety analysis of NextGen operational impact on LOC so as to not introduce new hazards as 
NextGen technologies and operational models are brought online. 

10) Research to support improved verification and validation of complex systems. 

These mitigation strategies and related foundational areas cross all operational regimes from commercial to 
general aviation. 

The programmatic challenges for addressing loss of control lie in selecting the sequence for developing the loss 
of control mitigations. Choices must be made regarding training for near-term impacts versus technology 
development for long-term impacts. Mitigations focused on training and recovery from loss of control will 
eventually reach a point of diminishing returns because of the insertion of human operators into a complex system. 
Technology solutions developed while NextGen is being formulated will be subject to currently unidentified 
hazards, requiring significant and expensive redesign. A blended investment that allows development of near-term 
and long-term solutions is required in order to make an immediate and lasting impact on the loss of control accident 
statistics. 


VIII. Conclusions 

Drawing upon statistics, accident reports, and analyses, and inputs solicited from industry stakeholders, the 
NASA Loss of Control study team developed a list of causal factors for loss of control accidents. Although the 
causal factors have been loosely organized into three categories: human- or pilot-induced, environmentally-induced, 
and systems-induced, no single category is solely responsible for loss of control accidents. Rather, accidents occur 
when combinations of breakdowns happen across human and engineering systems, often in the presence of threats 
posed by the external environment. 

Human-induced causal factors are a stronger contributor to loss of control accidents when compared to 
environmentally-induced and systems-induced causal factors. For near-term impacts on human-induced loss of 
control, mitigation strategies should focus on loss of control prevention and recovery training. Improved loss of 
control prevention and recovery training techniques have the added benefit of providing loss of control mitigation in 
Part 91 operations, in which technology-based solutions are less likely to have an impact. The implication is that 
better models of the post-stall environment are required in order to develop appropriate training material and avoid 
negative training. Technology-based solutions such as automatic energy management systems, envelope protection 
and envelope limiting, better human-machine interfaces to automation, improved health monitoring of aircraft 
systems, and improved verification and validation methods for increasingly complex systems are required for long- 
term impacts. 

Avoidance and detection of loss of control events are more important strategies when compared to recovery- 
based mitigations, however, development of recovery-based mitigations are also required in order to ensure 
complete coverage when “breaking the chain’’ of events in a loss of control scenario. Onboard systems that 
eliminate, or protect the aircraft from entering, a loss of control scenario are most effective. Avoidance and detection 
of loss of control events should not be limited to real-time, onboard systems, but should include data mining of 
incident reports, accidents reports, and flight operations quality assurance data to identify trends and conditions that 
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lead to loss of control so that the precursors may be eliminated or minimized. Off-board solutions should also 
include technologies to avoid weather and atmospheric related hazards such as icing and wake vortex encounters. 

Special attention should be paid to the Next Generation Air Transportation System as new technologies and 
operational models are developed to identify and mitigate new loss of control hazards. The introduction of new 
technologies that are intended to mitigate hazards can introduce unforeseen hazards. As Next Generation Air 
Transportation System technologies and operational procedures are integrated into the national airspace, we may see 
a rise in loss of control accidents because of increased traffic and congestion and changes in the way the national 
airspace is used. Early identification and mitigation of potential hazards will continue to be a challenge in this 
evolution. Improved methods for verification and validation of Next Generation Air Transportation System 
technologies will become increasingly important as the complexity of onboard and off-board systems increases. 

Aircraft loss of control will continue to be a challenging hazard because of the nature of flight, the demands on 
aircraft performance and capacity in the airspace system, and the increasing complexity of operations, onboard and 
off-board systems. Continued diligence by operational, research, and regulatory organizations is required in order to 
improve the civil aviation safety record. 
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Abstract 



Loss of control is the leading cause of jet fatalities worldwide. Aside from their 
frequency of occurrence, accidents resulting from loss of aircraft control seize 
the public’s attention by yielding a large number of fatalities in a single event. 

In response to the rising threat to aviation safety, the NASA Aviation Safety 
Program has conducted a study of the loss of control problem. This study 
gathered four types of information pertaining to loss of control accidents: (1 ) 
statistical data; (2) individual accident reports that cite loss of control as a 
contributing factor; (3) previous meta-analyses of loss of control accidents; and 
(4) inputs solicited from aircraft manufacturers, air carriers, researchers, and 
other industry stakeholders. Using these information resources, the study team 
identified the causal factors that were cited in the greatest number of loss of 
control accidents, and which were emphasized most by industry stakeholders. 
This report describes the study approach, the key causal factors for aircraft 
loss of control, and recommended mitigation strategies to make near-term 
impacts, mid-term impacts, and Next Generation Air Transportation System 
impacts on the loss of control accident statistics. 
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Loss of Control defined 


2000 CAST JSAT 
Report on Loss of 
Control 



Loss of control to includes significant, unintended 
departure of the aircraft from controlled flight, the 
operational flight envelope, or usual flight attitudes, 
including ground events. "Significant" implies an event 
that results in an accident or incident. This definition 
excluded catastrophic explosions, CFIT, runway collisions, 
complete loss of thrust that did not involve loss of control, 
and any other accident scenarios in which the crew retained 
control. This does include loss of control, due to aircraft 
design, aircraft malfunction, human performance, and 
other causes 
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Current NASA LOC Research: 
I RAC-FAST Ob' “ 


Can Modem Control 
Systems Help the Pilot Out 
Even More Than 
Traditional Methods???? 


• The above were survivable accidents; IRAC maybe able to help more. 

• Objectives 

- Regain a Stable Platform 

• Evaluate Robustness metrics for nonlinear adaptive systems 

- Maneuverability (can you fly it around) 

• Control vehicle within new constraints / structural loads etc.. 

- Provide the ability to safely land the airplane 

• Develop safest recovery trajectory 

The current IRAC work falls under the mitigation categories of 

Avoidance and Recovery 



Boeing’s Annual Report (International 
accidents included) 



Fatalities by CAST/ICAO Common Taxonomy Team (CICTT) 
Aviation Occurrence Categories 

Fatal Accidents - Worldwide Commercial Jet Fleet - 1999 Through 2008 


1926 ( 65 ) 


Fatalities 


LOC-I 

CFIT 



External fatalities [Total 253] 
Onboard fatalities [Total 4717] 


961 ( 0 ) 


/ 


Onboard fatalities 

External fatalities 




408 ( 23 ) 426 ( 4 ) 




156 ( 69 ) 146 ( 69 ) 193 ( 10 ) 


ARC Abnormal Runway Contact 

CFIT Controlled Right Into or Toward Terrain 

F-NI Hre/Smoke (Non-Impact) 

FUEL Fuel Related 

LOC-G Loss of Control - Ground 

LOC-I Loss of Control - In flight 

MAC Midair/Near Midair Collision 

OTHR Other 

RAMP Ground Handling 

RE Runway Excursion 

RI-VAP Runway Incursion - Vehicle, Aircraft or Person 

SCF-NP System/Component Failure or Malfunction (Non-Powerplant) 

SCF-PP System/Component Failure or Malfunction (Powerplant) 

UNK Unknown or Undetermined 

USOS Undershoot/Overshoot 

WSTRW Windshear or Thunderstorm 

No accidents were noted in the following principal categories: 

ADRM Aerodrome 

AMAN Abrupt Maneuver 

ATM Air Traffic Management/ Communications, Navigation, Surveillance 

CABIN Cabin Safety Events 

EVAC Evacuation 

F-POST Fire/Smoke (Post-Impact) 

GCOL Ground Collision 

ICE Icing 

LALT Low Altitude Operations 

Rl-A Runway Incursion — Animal 

SEC Security Related 

TURB Turbulence Encounter 

For a complete description go to: 
http^/www.intlaviationstandards org/ 


B n 1=] 123(3) 125(0) 120(0) 107(1) 

II II n n n n 


23 ( 0 ) 0 ( 7 ) 2 ( 2 ) 


1 (0) 


Number of 
fatal accidents 

LOC-I 

CFrr 

RE- SCF-NP 

Landing + 

ARC + 

USOS 

me 

RE- 

Takeoff 

RI-VAP 

OTHR 

LOC-G 

UNK 

WSTRW 

FUEL 

RAMP 

SCF-PP 

F-NI 

(91 total) 

-► 22 

17 

15 5 

2 

4 

4 

5 

1 

2 

2 

1 

7 

3 

1 


^ /r/7/y/v/7 


Note: Principal categories as assigned by CAST. 
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LOC Study team objective 



• This study team is to provide a systematic, data- 
driven analysis of the fundamental research required 
to address loss of control, 

• Fourth Quarter CY09 

• Study team expertise 

- All four NASA research centers represented 

- Skills on the team: flight control, flight dynamics, loss of 
control, flight research, aircraft icing, human factors, flight 
training, pilot-human automation, human performance, and 
human error. 

• A hybrid approach was adopted 
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LOC Study Team Approach (3 months) 


Review statistical data; Statistics are good 
at categorizing accidents but don’t provide 
much insight into mitigations 

Review some individual accident reports 
that cite loss of control as a contributing 
factor; 

Interviewed stakeholders 

Review previous meta-analyses of loss of 
control accidents; 
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LOC Study Team Approach (cont...) 



• Identified causal factors that were cited in the 
greatest number of loss of control accidents, and 
which were emphasized most by industry 
stakeholders. 

• For each causal factor that was linked to loss of 
control, the team solicited ideas about what 
solutions are required and future research efforts 
that could potentially help avoid their occurrence 
or mitigate their consequences when they 
occurred in flight 
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Analysis of accidents in the Boeing 
Statistical Summary LOC-I category 



Causal factor 
category 

# Accidents 
as Primary 
CF 

# Accidents as 
Contributing CF 

Pilot/human 

induced 

16 

22 

Environmental 

induced 

4 

5 

Systems 

induced 

2 

7 


LOC-I Accidents that occurred in each causal factor category 1999-2008 


Accidents identified from the LOC-I category in the Boeing Statistical 
Summary of Commercial Jet Airplane Accidentsl 999 - 2008 

10 




Analysis of accidents in the Boeing 
Statistical Summary LOC-I category 


Causal factor 

|# Accidents w/CF 

Pilot/human induced 


Improper Procedure 

10 

Spatial disorientation 

6 

Poor energy management 

6 

Distraction 

5 

Improper training 

5 

Poor design 

2 

Environmental induced 


Weather 

3 

Icing 

2 

Wake vortex 

1 

Systems induced 


Aircraft systems failures 

5 

Poor Design 

2 


Causal factors contributing to LOC-I commercial aircraft fatalities 1999 - 2008 



Analysis of accidents in the Boeing 
Statistical Summary LOC-I category 


Region 

Number of fatal accidents 

Asia fex China] 

6 

Europe 

5 

Africa 

4 

Latin America/Caribbean 

3 

CIS 

2 

Middle East 

1 

USA/Canada 

1 

China 

0 


Regions where fatal LOC-I commercial aircraft fatalities occurred 1999-2008 
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Analysis of accidents in the Boeing 
Statistical Summary LOC-I category 


Phase of flight 

Number of fatal accidents 

Climb 

6 

Take off 

5 

Final approach 

3 

Initial climb 

2 

Cruise 

2 

Initial approach 

2 

Landing 

2 


Flight phase where fatal loss of control accidents occur 1999 - 2008 
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Observations from the accidents in the 
Boeing Statistical Summary, LOC-I 


A 



• Finding 1 : Out of the 22 accidents in the LOC- 
I occurrence category, the leading causal 
factors come from pilot/human induced 
category 

• Finding 2: For large aircraft, the majority 
(95%) of recent LOC-I fatal accidents occur 
outside of the United States and Canada. 

• Finding 3: The majority (81%) of recent LOC-I 
accidents occur during flight phases where 
the aircraft is relatively close to the ground 
where there is little time for action, and where 
circumstances are unforgiving of mistakes. 


Observations from the accidents in 
the Boeing Statistical Data 



• Finding 4: Flight crew deviation from 
prescribed procedure is a very significant 
factor in loss of control accidents. 

• Finding 5: Spatial disorientation is a problem, 
but it occurs primarily outside of the United 
States. 

• Finding 6: Poor energy management (e.g. 
aerodynamic stall) is a significant factor in 
loss of control accidents. 


The Boeing Data only focus on Aircraft greater than 60,000 lbs. 
Further Insight into smaller AC were needed 


NASA Systems Analysis Report of 
Aircraft Loss of Control 



• “Causal Factors and Adverse Conditions of 
Aviation Accidents and Incidents Related to 
Integrated Vehicle Aircraft Control” NASA 
TM-201 0-21 6261 

• Examines, Part 121, Part 135 scheduled and 
nonscheduled operations, and Part 91 

• Dataset includes accidents and incidents from 
1988-2004 
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Type of events 

Operation Category 

Part 121 

Scheduled 
Part 135 

Non-Scheduled 
Part 135 

Part 91 

Part 91, 135, & 121 
Combined 

Total Flight Hours 

251,751,143 

25,353,146 

49,588,000 

441,207,000 

767,896,289 

Total Accidents 

630 

217 

1115 

24473 

26435 

LOC Accidents 

26 

(4% of Total 
Accidents') 

32 

(15% of 
Total 

198 

(18% of Total 
Accidents') 

4961 
(20% of Total 
Accidents') 

5217 

(20% of Total Accidents) 

LOC Accidents per 
million flight hours 

0.10 

1.26 

4.03 

11.24 

6.79 

Fatal Accidents 

62 

(10% of total 
accidents) 

49 

(23% of 
total 
accidents) 

293 

(26% of Total 
Accidents) 

4815 
(20% of Total 
Accidents) 

5289 

(20% of Total Accidents) 

Fatal LOC 
Accidents 

21 

(81% of 
LOC 
accidents) 

19 

(59% of 
LOC 
accidents) 

128 

(65% of LOC 
Accidents) 

2635 
(53% of 
LOC 
Accidents) 

2803 
(54% of LOC 
Accidents) 

Total Fatalities 

2165 

328 

698 

9146 

12337 

Fatalities in LOC 
Accidents 

1186 

(55%) 

161 

(49%) 

285 

(41%) 

5178 

(57%) 

6810 

(55%) 

Total Incidents 

7808 

2234 

2201 

29520 

41,763 

LOC Incidents 

38 

5 

8 

81 

132 

LOC Incidents 







per million flight 


hours 


0.151 


0.197 


0.161 


0.18 


0.17 




































































Observations from the data in the NASA 
Systems Analysis study on LOC 



• Finding 7: More than half of LOC-I events 
result in an accident and more than half of 
those accidents are fatal. 

• Finding 8: In approximately 1/3 of Part 121 
loss of control accidents, loss of control was 
due to a system component failure. 

• Finding 9: Approximately 34% of all fatal Part 
121 accidents are LOC accidents 

• Finding 10: In approximately 1/3 of Part 121 
accidents, the NTSB determined control was 
not possible. 
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Mitigations 


a 



• Mitigation Hierarchy (From system 
Safety Fundamentals) 

- Design/Eliminate the hazard 

- Safety devices to minimize risk 

- Detect/Warn 

- Procedures/Training 

- Placards 
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Mitigation Classification for LOC 



• Avoid: Avoidance is usually tied to design of 
systems that eliminate the hazard and safety 
mitigations but may also include standard operating 
procedures and training to avoid loss of control 
scenarios. 

• Detect: Detection is tied to the detect/warn category 
of mitigations and these mitigation strategies but may 
also include training to recognize the onset of a 
hazardous situation. 

• Recover: Recovery is the last line of defense and 
has strong ties to the procedures/training category, 
but may also benefit from automatic systems, safety 
devices and warning devices to aid in the recovery of 
the vehicle. 


Mitigation Development strategy 


a 



• Near term impact (5-10 yrs): LOC Training, 
Better standard operating procedures 

• Mid Term impact (5 - 20 yrs): IVHM, 
improved displays, aircraft attitude and 
energy management tools, envelope 
protection/limiting, improved automation and 
warning systems, adaptive control 

• NextGen impact (Long term): Aircraft 
design, system architectures, improved V&V 
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Mitigations and statistical summaries 


• Statistical Summaries don’t do a good 
job of pointing to mitigations due to the 
loss of the supporting details. 

• Understanding the details of accidents 
are important 

• Discussing candidate mitigations with 
stakeholders provides good insight into 
mitigations 
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Stakeholders consulted during the 
Aircraft LOC Study 


• Regulatory agencies 

- FAA 

- NTSB 

• Operators 

- Air Line Pilots 
Association (ALPA) 

- Commercial pilots 

- Safety directors for 
Airlines 


• Manufacturers 

- Boeing 

- Airbus 

- Honeywell 

• Other organizations 

- CAST members 

- NASA 

- CALSPAN 

- Flight Safety 
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Stakeholder feedback: 
Research Needs 



Envelope protection, envelope limiting and energy 
management (Avoid LOC). Stakeholders indicated that a 
high-priority mitigation toward preventing LOC is inhibiting 
an otherwise healthy aircraft from entering an unsafe 
condition. 

1) Envelope protection: understand the benefits and 
identifying potential hazards 

2) Envelope limiting: 

3) Displays and automation for improved energy 
management 

4) Automatic use of the propulsion system for envelope 
protection: 

5) Partnerships to participate in verification and validation of 
these technologies. 


Stakeholder feedback: 

Research Needs (Continued. ...) 



Improved automation for human factors Mitigation (Avoid LOC). 

Stakeholders indicated that complexity of automatic systems, poor 
system architecture and a lack of human factors considerations in 
automatic systems are a key causal factor in aircraft loss of control. 
Potential mitigations include; 

• 1) Reduced complexity in automation interfaces 

• 2) Improved models of systems for increased pilot understanding 

• 3) Improved feedback to the pilot about the state of automatic systems 

• 4) Improved coordination between autopilot and autothrust systems 

• 5) Automatic prevention of loss of control and pilot aids for recovery 
from a loss of control event. 

• 6) Reduced “startle factor” for changes in automation (“bark before 
bite”) 
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Stakeholder feedback: 

Research Needs (Continued. ...) 



Training for upset recovery and prevention (Avoid, Detect, and 
Recover from LOC). 

• Stakeholders are widely divided on the topic of training for loss 
of control recovery and prevention. 

• Pilot unions and operators are at odds with regard to upset 
prevention and recovery training. 

Key needs toward addressing LOC prevention and recovery 
training: 

1) Research to develop training products for externally-induced 
loss of control (icing, wind shear, wake vortex, turbulence, 
heavy rain). 


Stakeholder feedback: 

Research Needs (Cont i nued. ...) 

Key needs toward addressing LOC prevention and recovery 
training: 

2) Identify the most effective way to train pilots to mitigate loss of 
control events: 

a) Determine effective ways to utilize the URTA in training. 

b) ID advantages and hazards with using motion-based and fixed- 
based simulations for training. 

c) Perform research to understand where motion in simulation is 
most effective (seat cushion, gyroscopic devices, in-flight 
simulation, aerobatic training). 

d) Prevention and recovery training: perform research that would 
give regulators, manufacturers, and operators guidance on the 
effective use of prevention training and the appropriate use of 
recovery training. 

e) Research to determine when URT should be introduced to pilots 
during their career and how often to train for upset recovery to 
maintain proficiency. 



Stakeholder feedback: 

Research Needs (Cont i nued. ...) 

Aerodynamic and dynamic model development for upset prevention 
and recovery (Recover). 

• Stakeholders concerned about adequately modeling aircraft dynamics 
beyond the nominal flight envelope or in the presence of external 
influences such as wake vortex or icing. 

• Inaccurate modeling may lead to negative training (AA587). 

• key needs in the areas of aerodynamic and dynamic model 
development for upset prevention and recovery are: 

1) Methods for accurate and cost-effective modeling outside the normal 
flight envelope 

2) Development of generic models for upset prevention and recovery that 
include: 

• Multiple configurations, Generic trends in models that can be used in 
training, Evaluate the effectiveness of generic models in training for 
specific aircraft types, Generic models that do not contribute to 
negative training 

3) Research to determine control effectors most appropriate for loss of 
control recovery: Control effectiveness in unusual attitudes, Use of the 
propulsion system as an effector, Control allocation strategies. 



Stakeholder feedback: 

Research Needs (Cont i nued. ...) 

Detection and notification of pending upset condition (Detect). 

Stakeholders consistently emphasized the need to identify the 
development of a pending upset condition and provide the crew with 
sufficient information so they can take appropriate action to prevent an 
upset. Quite often the crew are caught off guard at the onset of an 
upset condition and have only seconds within which to identify the 
correct response. Incorrect responses may lead to an unrecoverable 
condition. Technologies are needed that: 

1) Identify and warn of degraded energy states 

2) Provide asymmetric thrust detection and notification 

3) Identify and notify of spatial disorientation 

4) Predict and mitigate PIO 

5) Detect icing conditions and buildup and provide notification 

6) Detect aircraft aerodynamic changes using real time system 
identification. 



Causal factors 


Human Induced 

- Manual handling 
errors 

- Poor Energy 
Management 

- Automation Effects 
On Human Induced 
Loss-Of-Control 

- Spatial 
Disorientation 

- Improper 
Procedures 


Systems Induced 


Externally Induced 

- Poor systems design 


- Icing 

- Poor energy 


- Turbulence 

management 


- Degrading Visibility 

- Poor redundancy 


- Heavy Rain 

management 


- Low-Level 

- Autopilot modes leading 
to loss of control 

- Erroneous sensor data 

- Pilot induced oscillation 

- Loss of control power, 
authority, or effectiveness 

- Display errors 

- Propulsion system faults/ 
failures/damage 

- Fire 


Windshear 


Human induced LOC: 

Manual Handl i ng Errors 

CF: Inadequate Pilot Training for Upset Prevention and 

Recovery: inappropriate or erroneous control inputs by the flight crew in 

response to abnormal events or flight regimes. 

Mitigation: Improved upset recovery training 

- Study the impact of upset recovery training during transitional flight 
training 

- Study the effectiveness of providing pilots with an enhanced 
understanding of the behavior of an aircraft near or outside the limits of 
normal flight regimes. 

- Manual control strategies during upset recovery 

- Development of aerodynamics and dynamic models for out of envelope 
conditions (including generic models) 

- Understanding the importance of simulator motion in upset recovery 
training. 

- Evaluate the use of In-flight simulators for Upset Recovery Training. 
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Human induced LOC: 

Manual Handling Errors 

CF: Atrophy Of Manual Flying Skills 

Mitigation: Provide pilots with increased opportunity to exercise manual 

flying skills. 

- Assess how specific automated systems, both inside and outside the 
cockpit, are affecting the retention of manual flying skill. 

- Develop guidelines for frequency of manual flight time for normal and 
abnormal operations in order to maintain pilot proficiency. 

- Identify ways in which manual navigation, guidance, and control skills can 
be regularly practiced during normal flight operations in order to keep 
manual skills sharp. 

CF: Poor Aircraft Handling Qualities During Upset Events 

Mitigation: Develop automatic control mechanisms to prevent LOC, recover 

or aid in the recovery of the airplane 

- Control aids for prevention and recovery from LOC . 
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Human induced LOC: 

Poor Energy Management 

CF: Poor Energy Management 

Mitigation: Improve pilot awareness of energy state. 

- Display and alerting methodologies for critical aircraft configuration states. 

- Design criteria and methodologies for low energy alerting and warning 
systems. 

- Improved envelope protection and envelope limiting systems to maintain 
energy state. 
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Human induced LOC: 
Automation Effects On HI-LOC 



CF: Automation Confusion/Mode Confusion 

•Pilot misunderstanding of automation 

•Poor feedback to the pilot about the state of automation 
systems 

•Lack of understanding of automation systems by the pilot 
•Failure of automation system 

Mitigation: Develop more simple pilot interfaces to prevent confusion about 
automation. 

- Human Centric Pilot interfaces. 

- Human Centric Verification and Validation Methods . 

- Develop Human Centric Models of Automatic Systems 

- Procedures-plus-concepts training 

- Research to determine most appropriate information to display to the pilot 
about the state of the automation 


Systems Induced Loss of Control 


• Flight critical components are designed to 
have a failure rate of 10 9 per hour of 
operation 

• System/Component failure is a trigger for 
LOC in; 

- 1/3 of Part 121 LOC accidents 

- 11% of Part 135 LOC accidents 

- 8% of Part 91 LOC accidents 
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Systems Induced Loss of Control 
Causal factors 



• Poor systems design 

- Poor energy management 

- Poor redundancy management 

- Autopilot modes leading to loss of control 

- Pilot induced oscillation (PIO) 

• Air traffic operations 

- Unstable approaches 

• Aircraft system faults/failures/damage (non 
propulsion) 

- Erroneous sensor data 

- Loss of control power, authority, or effectiveness 

- Automation and display errors 

• Propulsion system faults/failures/damage 

• Fire 


Systems Induced LOC: 
Faults, Failures and Damage 



Non fly-by -wire-aircraft (Commuter and GA) 

Causal Factor: Poor energy management due 
to faults, failures or damage 

Mitigation: Loss of control prevention and recovery 
systems for non-fly-by-wire aircraft: 

- Participate in the development of automatic LOC 
prevention and recovery systems for non-fly-by- 
wire aircraft 

- Participate in the development of techniques and 
guidance for recovery from LOC for non-fly-by- 
wire aircraft. 
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Other Systems related Mitigations 
and Research 



• System Safety analysis of NextGen 
operations 

• Forensics and trend prediction 

- Data mining FOQA, ASIAS and ASRS data for LOC trend 
information, causal factors and precursors to LOC 
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Environmentally Induced LOC 


• Not as significant of a factor as human 
induced LOC 


Causal Factor 

Part 121 and 135 

Part 135 

Part 91 


Scheduled 

Unscheduled 



(40 LOC accidents) 

( 159 LOC accidents) 

(4287 LOC accidents) 

Icing 

54% 

27% 

6% 

Turbulence 

11% 

22% 

20% 

Degrading Visibility 

9% 

14% 

18% 

Heavy Rain 

6% 

5% 

2% 

Low-Level Windshear 

4% 

3% 

2% 
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Mitigation and Technical Challenges 


• Improved health monitoring of aircraft systems 

• Improved modeling in adverse conditions such as out-of- 
envelope flight 

• Research to support loss of control training 

• Maneuvering boundary identification and envelope limiting 

• Pilot increased awareness about the health and state of the 
aircraft 

• Integrated aerodynamics and propulsion control 

• Automatic control system technology to provide good handling 
qualities 

• Data mining for trend identification 

• System Safety Analysis of NextGen operational impact 

• Research to support improved verification and validation of 
complex systems. 
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Conclusions 


• Human induced LOC causal factors are a stronger contributor to 
LOC accidents when compared to Systems induced and 
Environmentally induced causal factors. 

• Avoidance and detection mitigations should be higher priority 

than recovery based mitigations but 

• Recovery based mitigations are important for coverage of 
“breaking the chain” of events. 

- Prevention and Recovery Training may have a nearer term impact 
than technology based solutions. 

• New technologies and NextGen operations may introduce new 
and unforeseen LOC hazards. 

- Hazard analysis is required 

- Data mining of FOQA, NTRS and ASRS 

• Verification and Validation methods need improvement to keep 
pace with NextGen complexities 
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